Civil Liability for Man-in-the-Middle Scams in Corporate Payments

1. The facts

   The case, as reported by outlets such as Altalex, belongs to a context of serial litigation that has reached a consolidation phase in the courts of merit. The typical dynamic involves a company awaiting an invoice from a regular supplier, which receives an apparently legitimate email communication announcing a change in banking details for the balance. In reality, a cybercriminal has inserted themselves into the email chain (Business Email Compromise), replacing the original IBAN with that of a so-called money mule. The company employee, without performing further telephone verification, orders the wire transfer. The ordering bank executes the operation based on the IBAN, and the receiving bank credits the funds to an account often opened with superficial identification procedures, allowing the scammer to withdraw the money immediately. The procedural stage of these cases is predominantly that of first instance and civil appeal, where companies sue institutions for failing to detect the obvious discrepancy between the beneficiary's name indicated in the transfer and the actual holder of the receiving bank account.

2. 

   The legal framework

   1. Art. 1176, paragraph 2, of the Civil Code imposes a professional diligence on the bank superior to that of a reasonable person, obliging it to use technical tools suitable for preventing frauds detectable with ordinary industry expertise.
   2. Art. 24 of Legislative Decree no. 11/2010 establishes that the IBAN is the unique identifier for payment execution, but the rule does not exempt the bank from liability if the damage stems from intent or gross negligence in managing the security system.
   3. Art. 1227 of the Civil Code regulates the contributory negligence of the creditor, allowing the judge to reduce the compensation amount if the scammed company contributed to the damage by failing to monitor the security of its IT communications.

3. What the case law says

   The case law of the Supreme Court has clarified that payment service providers must act as prudent bankers, which implies a protection obligation towards the client that goes beyond simple mechanical execution of orders. In particular, several courts of merit have established that, if there is a macroscopic divergence between the IBAN and the beneficiary's name, the receiving bank cannot remain inactive, as current technology easily allows for a consistency check (so-called cross-check). The prevailing orientation suggests that the bank is liable if it does not prove it adopted all security measures consistent with the state of the art to intercept anomalous operations. However, judges tend to almost always recognize contributory negligence on the part of the victim company, ranging between 30% and 50%, if the scam was facilitated by negligent password management or the failure to check obvious anomalies in the sender's email address (such as minor spelling errors in the domain).

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. It is essential to advise client companies to adopt double-verification protocols (by telephone or through encrypted channels) for every change in banking details received via email.
   2. In litigation, the lawyer must focus on proving the failure to implement the name-IBAN consistency check as a violation of the professional diligence of a prudent banker.
   3. It is necessary to pre-evaluate the impact of the employee's contributory negligence, preparing defensive strategies that demonstrate the sophistication of the cyberattack to reduce the company's share of liability.

References: Art. 1176 c.c.Art. 1227 c.c.D.Lgs. n. 11/2010Direttiva UE 2015/2366 (PSD2)

Editorial oversight: Avv. Federico Papa·ICAMUpdated 5 September 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction